An AI task should begin with an allowed data boundary, not with every source the user can reach.
Four checks before sharing data
- Purpose: Is this information necessary for the stated task?
- Authority: Is the user and system allowed to use it this way?
- Sensitivity: Does it contain personal, confidential or regulated information?
- Lifecycle: Where will the input and output be stored, logged and deleted?
Data minimisation improves both safety and answer quality. Irrelevant material introduces noise, conflicting instructions and information the output never needed.
Permission follows the action
Reading a record, creating a draft and changing a system of record are different permissions. Grant each separately and keep write access narrow.